ISO 27001 Annex A is the single most searched phrase in vendor security reviews, and the question behind it is simple: what does a supplier's certificate actually promise to apply. ISO/IEC 27001:2022 lists 93 controls in Annex A, organised under four themes, and every certified organisation selects which ones are relevant to its own Statement of Applicability. That selection, not the control list itself, is the document that tells a buyer anything useful. This piece works through the structure of Annex A, what a public Statement of Applicability tends to disclose, and which supplier-facing controls deserve a direct question rather than a tick box, drawing on the index's ISO 27001 supplier controls regulation page rather than a generic control list, because the generic list reads the same for every vendor and the Statement of Applicability does not.
What Annex A actually is
ISO/IEC 27001 sets out the requirements for an information security management system in its main clauses, numbered 4 to 10. Annex A is a reference set of controls drawn from the companion standard ISO/IEC 27002, offered as a menu rather than a mandate. A certified organisation is not required to apply every control in Annex A. It is required to run a risk assessment, decide which controls address its risks, document the result in a Statement of Applicability, and justify any exclusions. The certificate itself confirms that this process happened and that an accredited body audited it. It does not list which controls were chosen.
The four control themes, and why the split matters
The 93 controls in Annex A sit under four themes: organisational, people, physical and technological. The organisational theme is by far the largest, which is a useful thing to know before asking a vendor for its control list, because most of what a buyer actually cares about in a vendor relationship, supplier management, incident handling, access control policy, sits in that bucket rather than in the physical or people themes.
| Theme | Control count | Example control | What it typically governs |
|---|---|---|---|
| Organisational | 37 | A.5.19 Information security in supplier relationships | Policy, roles, supplier contracts, incident process |
| People | 8 | A.6.3 Awareness, education and training | Screening, training, disciplinary process |
| Physical | 14 | A.7.4 Physical security monitoring | Data centre and office physical controls |
| Technological | 34 | A.8.24 Use of cryptography | Encryption, logging, network and endpoint security |
Control counts per theme, ISO/IEC 27001:2022 Annex A, based on ISO/IEC 27002:2022.
Why the Annex A list alone tells a buyer nothing
A vendor can state that it is certified to ISO/IEC 27001 and that fact alone says almost nothing about what was in scope. Two vendors can both hold valid certificates while one excludes its customer support tooling from scope and the other includes it. Annex A does not change that. It is the same 93-control menu for a five-person startup and a global cloud provider. What differs is the Statement of Applicability: which controls were marked applicable, which were excluded and why, and what scope statement sits above the whole document. A buyer who asks for the Annex A controls is really asking for the menu. A buyer who asks for the Statement of Applicability is asking for the order that was actually placed.
Annex A of ISO/IEC 27001:2022 lists 93 information security controls, derived from ISO/IEC 27002:2022 and organised under four themes, for selection and justification in an organisation's Statement of Applicability.
What a public Statement of Applicability actually discloses
Few vendors publish the full Statement of Applicability, and that is reasonable, because the document can describe internal architecture in detail that a competitor would value. What a trust centre or security page more commonly shows is a scope statement, a certificate number and expiry, and sometimes a short summary of which control themes were addressed. Related certifications such as ISO/IEC 27017 for cloud security controls or ISO/IEC 27018 for personal data in the cloud are worth checking separately, since they extend specific Annex A controls rather than replace them, a distinction covered in more detail in ISO 27017 vs 27018: what vendors actually publish.
| Annex A control | What it covers | Typical public evidence | What usually stays private |
|---|---|---|---|
| A.5.19 Supplier relationships | Security requirements for onboarding suppliers | A sentence in the trust centre narrative | Actual due diligence records |
| A.5.20 Security in supplier agreements | Contractual security terms | A data processing agreement link | Negotiated contract clauses |
| A.5.21 ICT supply chain security | Fourth-party and subcontractor risk | Rarely shown in a public summary | Supplier risk assessments |
| A.8.24 Cryptography | Encryption and key management | A high-level statement of encryption in transit and at rest | Key rotation and management procedures |
Supplier-facing Annex A controls mapped against what buyers can typically see without a signed NDA.
A trust centre that lists several ISO certificates side by side is a good place to see how scope statements and related standards sit next to each other in practice, which is the point worth checking rather than any single figure on the page.
Docebo · Trust report
Education · Public evidence as of 25 Oct 2026
Framework overview
CertReports state for each framework with public evidence: 2 verified, 9 vendor-stated.
ISO 27001Vendor-statedTrust centre · 30 Sep 2026
FedRAMPVerifiedModerate impact
DPFVerifiedValid to 30 Dec 2026
SOC 2Vendor-statedTrust centre · 30 Sep 2026
GDPRVendor-statedTrust centre · 30 Sep 2026
PCI DSSVendor-statedTrust centre · 30 Sep 2026
ISO 27701Vendor-statedTrust centre · 30 Sep 2026
ISO 27017Vendor-statedTrust centre · 30 Sep 2026
ISO 27018Vendor-statedTrust centre · 30 Sep 2026
5Documents and agreements
Legal and review documents Docebo publishes or offers, as of 30 Sep 2026.
- Standard contractual clauses · On request
- Subprocessor list · Public
- Privacy policy · Public
- AI and data use policy · Public
- Public trust centre documents · Docebo SOC2 Report Renewal Statement (Bridge letter); Docebo ISO 27001, 27701, 27017, and 27018 latest certificate; Docebo ISO 9001 Certificate
2Security practices
Public statements from Docebo, shown as statements, not attestations, as of 30 Sep 2026.
- Penetration testing · annual
- Data residency · Australia, Canada, EU, India, US
1Subprocessors
Named on Docebo's public subprocessor list, last seen 30 Sep 2026.
The certificate confirms a process, not a control set
A valid ISO 27001 certificate confirms that an accredited body audited the management system and the Statement of Applicability behind it. It does not confirm which of the 93 Annex A controls were marked applicable, only that whatever was marked applicable was tested.
Supplier-facing controls worth naming in a questionnaire
Instead of asking a vendor to confirm it applies all 93 controls, a buyer gets further by naming the handful of controls that actually govern the vendor relationship and asking for the evidence behind each one.
- 1
Ask for the scope statement first
Request the one paragraph that defines which systems, offices and services sit inside the certified management system before asking anything else.
- 2
Name A.5.19 and A.5.20 directly
Ask how supplier security requirements are set and reviewed, and whether those terms appear in the contract the buyer is about to sign.
- 3
Ask about A.5.21 fourth-party coverage
Request confirmation of whether the vendor's own subprocessors and subcontractors are assessed under the same management system.
- 4
Check A.8.24 against the data classification
Confirm the cryptography control covers the specific data types the buyer will send, not just a general encryption statement.
- 5
Match the certificate date to the standard edition
Confirm the certificate cites ISO/IEC 27001:2022, since certificates citing the 2013 edition lapsed on 31 October 2025 under IAF MD 26.
- The current certificate, including scope statement and accreditation body
- Confirmation of which standard edition the certificate cites
- A summary or extract of the Statement of Applicability covering supplier controls
- Any linked certifications, such as ISO/IEC 27017 or ISO/IEC 27018, and what each one adds
The 2013 to 2022 transition still trips up buyers
ISO/IEC 27001:2022 restructured the control set from the 114 controls in the 2013 edition down to 93, grouped under four themes instead of fourteen clauses. Certificates issued against the 2013 edition lapsed on 31 October 2025 under IAF MD 26, which means any vendor still citing the old edition today has no current public evidence of a valid management system, whatever its trust centre copy still says. The index has tracked how many vendor pages were still referencing the lapsed edition weeks after the deadline, covered in ISO 27001:2013 lapsed on 31 October 2025, vendor pages have not caught up, and the pattern is a reminder that a certificate badge on a marketing page is not the same as a current, verifiable listing.
ISO 27001 Annex A versus SOC 2's control approach
SOC 2 does not have an Annex A. Instead an auditor tests controls a vendor designs itself against the five Trust Services Criteria, and the resulting report describes what was tested and what the auditor found, not a fixed control menu. Buyers who are deciding which framework to ask for, or how to read both documents side by side, will find the trade-offs set out in SOC 2 vs ISO 27001: what to ask vendors for. In short, Annex A gives a buyer a known vocabulary to question a vendor with, even when the vendor's own evidence is a SOC 2 report rather than an ISO certificate.
Reading the Statement of Applicability like a trust centre
The habits that work for reading a SOC 2 report or a trust centre apply here too: check the date, check the scope, and do not assume a logo means what the logo claims. How to read a trust centre in ten minutes sets out the same discipline for any public security page, and it applies directly to an ISO 27001 listing, where the certificate number and the scope paragraph matter more than the badge itself.
- 93
- Annex A controls
- ISO/IEC 27001:2022, four themes
- 4
- control themes
- Organisational, people, physical, technological
- 31 Oct 2025
- 2013 edition lapse date
- IAF MD 26 transition deadline
People also ask
What is ISO 27001 annex a?
Annex A is the reference list of information security controls attached to the ISO/IEC 27001 management system standard. It gives a certified organisation a menu of controls to select from after a risk assessment, documented in a Statement of Applicability, rather than a fixed checklist every certificate holder must apply in full.
What is the primary focus of ISO 27001 annex a controls?
Annex A controls focus on reducing information security risk across how an organisation is run, how people are trained and screened, how physical sites are protected, and how technology is configured and monitored. The organisational theme, covering policy, supplier management and incident handling, accounts for the largest share of the 93 controls.
How many controls in ISO 27001 annex a?
ISO/IEC 27001:2022 lists 93 controls in Annex A, down from 114 in the 2013 edition, organised under four themes: organisational, people, physical and technological. Certificates citing the 2013 edition and its 114-control list lapsed on 31 October 2025 under IAF MD 26.
What is ISO 27001 annex a controls?
They are the named security measures, such as supplier relationship management, access control and cryptography, that a certified organisation can choose to apply. A vendor's Statement of Applicability records which of the 93 controls were marked applicable, which were excluded, and the justification for each exclusion.
Solomon Amos · Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
Read next on CertReports
You might also like
ISO 27001:2013 to 2022: what the transition deadline means for vendor certificates
Solomon Amos · 1 Sep 2026 · 10 min read